EDPB: platforms may not force users to be tracked
Large online platforms, such as social media, may not force their users to be tracked across the Internet in order to use the platform. There must be an option for users to opt out of being tracked and an option where users do not have to pay and are tracked to a limited extent only. This is argued by the Dutch Data Protection Authority (DPA) and the other privacy regulators in Europe, united in the European Data Protection Board (EDPB).
The DPA, together with the Norwegian and German privacy regulators, had asked the EDPB to take a position on this issue. This is because some online platforms state that people can only continue to use the platform without paying, if they agree to their personal data being used for targeted advertisements.
Not a fair choice
The EDPB states that it is not a fair choice when users have to choose between a paid subscription without being tracked and a membership for which they ‘do not have to pay’, but indirectly they do: the "consent or pay" model. This model means that users are in fact forced to choose to ‘pay’ with their personal data. This is especially true if the price for a paid subscription is high.
Third option
The tech companies behind the online platforms must therefore offer a third option. This form of membership must be free. And one in which the user can be followed to only a limited extent. In that scenario, the advertisements that users are shown are not based on their behaviour on the entire Internet, but are, for example, contextual. This means that the advertisements match the content that someone is viewing on the platform. For example, an advertisement for a car in a post about cars.
This will be the standard for tech companies. If companies do not do this, they must prove that their approach still complies with the law.
Free, fair choice
Aleid Wolfsen, Chair of the Dutch Data Protection Authority (DPA): “Privacy is not just for rich people. You must be given a free, fair choice. A platform threatening to cancel your online account as soon as you do not agree to be tracked online is not a free choice. Tech companies are not allowed to force you to agree to tracking your behaviour on the Internet. And to go on and sell your data to advertising companies for example.”
Wolfsen continues: “When tech companies charge an unreasonably high price for a privacy-friendly option, they leave people with less spending power no choice. They often need such a platform. For example, for work or to stay in touch with family. Deciding against using the platform is not an option, but neither is coughing up the subscription costs. That’s not a choice, that’s coercion.”
Requirements for consent
The General Data Protection Regulation (GDPR) requires that companies that collect and use personal data must have a legal basis for doing so, consent being one of them. You must be able to give consent freely, without being pressured into it. You should also have the choice to refuse a company processing your personal data, without this having major adverse consequences..
Taking decisive action
Wolfsen is satisfied with the position that the supervisory authorities are now taking. “Large tech companies must comply with the law. This position is crystal clear and helps the responsible supervisory authorities take decisive action if they spot a violation.”
